What is GHSA-hqqc-4mgp-grm6?

GHSA-hqqc-4mgp-grm6 is a security advisory published by GitHub Security Advisories with High severity. A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated...

Which CVE IDs does GHSA-hqqc-4mgp-grm6 cover?

GHSA-hqqc-4mgp-grm6 covers the following CVE IDs: CVE-2026-72535. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hqqc-4mgp-grm6?

GHSA-hqqc-4mgp-grm6 has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

GHSA-hqqc-4mgp-grm6HighCVSS 8.6

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated...

Vendor

GitHub Security Advisories

Published

August 11, 2026

Last Modified

August 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-72535 →

📋 Description

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account. An attacker can access and manage subscription data for any tenant without credentials.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-72535
https://github.com/chaskiq/chaskiq
https://github.com/advisories/GHSA-hqqc-4mgp-grm6